/**
 * `olam rekey <world-id>` — rotate the per-world postgres password.
 *
 * Phase A9 of `olam-hybrid-shared-postgres`. Phase A4 (commit 7b4334ff)
 * landed `applyPostgresWorldRole` which already supports rotation via
 * `ALTER ROLE` when the role exists. A9 exposes that rotation as a
 * standalone operator-facing command, useful when:
 *
 *   - The operator wants to force-rotate credentials (suspected leak).
 *   - A world container lost its env-injected password (e.g. crashed
 *     before the app read it).
 *   - A future tmpfs cred-mount flow needs a re-inject path.
 *
 * Flow:
 *   1. Load context + WorldManager.getWorld(worldId).
 *   2. Hybrid + DB gates (exit 3 if non-hybrid or no per-world DBs).
 *   3. `applyPostgresWorldRole(id, worldDbNames)` → ALTER ROLE rotates
 *      the password atomically. The old password is gone.
 *   4. Write new password to `~/.olam/worlds/<id>/credentials.json`
 *      (chmod 600).
 *   5. `docker restart olam-<id>-devbox` so the container picks up the
 *      new password from env on next process start.
 *   6. Audit-log line to `~/.olam/usage.log` (SEC-002): timestamp +
 *      world-id + "rekey" — NEVER the password.
 *
 * Exit codes:
 *   0  success
 *   1  unexpected error
 *   2  world not found
 *   3  precondition failed (non-hybrid, no DBs, etc.)
 */
import type { Command } from 'commander';
import { type PostgresWorldRoleResult } from '@olam/core/src/world/manager.js';
import type { WorldMetadata } from '@olam/core/src/world/types.js';
export interface RekeyOptions {
    readonly print?: boolean;
    readonly json?: boolean;
}
export interface RekeyResult {
    readonly worldId: string;
    readonly worldRoleName: string;
    readonly password: string;
    readonly credentialsPath: string;
    readonly rotatedAt: string;
    readonly containerRestarted: boolean;
}
/**
 * Minimal dependency surface used by {@link doRekey}. Pure-function
 * injection lets tests run without docker, without disk writes outside
 * the test's tmp dir, and without mocking modules.
 */
export interface RekeyDeps {
    readonly getWorld: (id: string) => WorldMetadata | undefined;
    readonly applyPostgresWorldRole: (worldId: string, worldDbNames: ReadonlyArray<string>) => PostgresWorldRoleResult;
    readonly restartContainer: (containerName: string) => {
        ok: boolean;
        stderr: string;
    };
    /** Override for tests. Default: real fs + ~/.olam. */
    readonly olamHomeDir: () => string;
    readonly now: () => Date;
    /** Stream for human-readable lines (overridable for tests). */
    readonly stdout: {
        write(s: string): void;
    };
    /** Audit-log appender; default writes to `${olamHomeDir()}/usage.log`. */
    readonly appendAuditLog: (line: string) => void;
}
/** Domain-specific error carrying the documented exit code. */
export declare class RekeyError extends Error {
    readonly exitCode: number;
    constructor(message: string, exitCode: number);
}
/**
 * Core rekey logic. Returns the rotation result on success, throws
 * {@link RekeyError} with the documented exit code on failure.
 *
 * The password is held in this function's local binding and the
 * returned object only; it is written to disk with mode 0o600 and
 * NEVER logged or written to the audit trail (SEC-002).
 */
export declare function doRekey(worldId: string, deps: RekeyDeps): Promise<RekeyResult>;
export declare function registerRekey(program: Command): void;
//# sourceMappingURL=rekey.d.ts.map